Hospital Ransomware Attacks Associated with Increase of Number of Fatal Heart Attacks: Study

A new study shows that a hospital ransomware attack can lead to delayed care, which can increase the number of fatal heart attacks.

Krebs on Security reported that Vanderbilt University’s Owen Graduate School of Management analyzed the patient mortality data from the Department of Health and Human Services information from more than 3,000 hospitals. Each hospital in the study was Medicare-certified, and approximately 10 percent of them had been data breach victims.

Vanderbilt researchers found that up to 36 more fatalities per 10,000 treated heart attacks occurred each year at the hospitals that had experienced data breaches, reported PBS.

The study was co-led by Eric Johnson, an IT security researcher and dean of Vanderbilt University’s Owen Graduate School of Management. Johnson told PBS, “In spending time in a lot of different health care organizations, what we saw in terms of reactions to breaches was rather predictable – that is installing better security controls.”

Among the steps hospitals took were creating stronger passwords, using two-step authentication and enforcing password use every time data needed to be accessed.

Johnson said Vanderbilt’s research showed a link between an increased 30-day mortality rate and data breaches.

Doctors and other health care workers may be slowed down as the facility introduces technological changes that delay or cause a learning curve in health care IT as the facility introduces new processes regarding patient care.

Researchers found that hospitals that experienced a ransomware attack caused a patient to wait an extra 2.7 minutes to receive an electrocardiogram. The extra drag on the hospital’s response time continued for three or four years. Researchers reported that even years later, patients had to wait an extra two minutes to obtain the electrocardiogram. These are precious minutes lost for someone suffering from a heart attack because the care received (or not received) could make a difference between life and death.

Reasons for a Ransomware Attack

When a criminal hijacks the computer system of a hospital, the attack is usually initiated when an unsuspecting health care employee opens a link or attachment that is infected with malware. The malware may either encrypt the hospital’s data to hinder hospital health care workers from reading files or it may lock the data, preventing anyone who is authorized to access it from doing so.

The hackers hold the data until a ransom is paid to them through bitcoin, a monetary denomination in the online world that allows for users to remain anonymous.

In some cases, the hackers don’t release the data even after the ransom is paid, which leads to further critical down time for a health care organization. This scenario has prompted the FBI to advise against paying the demanded money in a ransomware situation.

In addition to making money by obtaining the ransom, hackers may reap profits in other ways after accessing patient information. According to PBS, hackers have used health care information to extort patients who don’t want anyone to know they have been diagnosed with certain illnesses. Hackers also may bill Medicare and Medicaid by creating false invoices based on the patient records they’ve received.

In those cases, the hackers may get away with fraudulently billing government health care services for a long time or may never be caught, according to Ross Koppel, a sociologist at the University of Pennsylvania, told PBS.

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.